Critical · published August 10, 2017
⚠️ A crafty web application can bypass your SecurityManager with just a few tricks! This vulnerability in Apache Tomcat is a sneaky way through your defenses! 🔥 Think of it like a hotel that has set strict rules about who can access certain areas. Now, imagine an unauthorized guest cleverly finds a way to sneak past the security desk using a staff-only access card left unattended — it’s all too easy! If exploited, a malicious web application could gain access to sensitive resources that should be tightly controlled. This could lead to unauthorized data access or even manipulation of critical application functions — absolutely devastating for your security posture!
Think of it like a hotel that has set strict rules about who can access certain areas. Now, imagine an unauthorized guest cleverly finds a way to sneak past the security desk using a staff-only access card left unattended — it’s all too easy! In Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, and 6.0.0 to 6.0.45, a utility method accessible to web applications enables them to bypass the configured SecurityManager, which is intended to restrict access to sensitive operations.
If exploited, a malicious web application could gain access to sensitive resources that should be tightly controlled. This could lead to unauthorized data access or even manipulation of critical application functions — absolutely devastating for your security posture! Update your Apache Tomcat to versions 9.0.0.M10 or 8.5.5 and above to close this bypass risk. Regularly review your security configurations to ensure they align with best practices for application security. 🛡️ You've got this! With the right updates, you'll keep your defenses strong and your applications safe! ✨
| Product | Versions | Fixed in |
|---|---|---|
| apache/tomcat | ≥ 6.0.0, ≤ 6.0.45 | — |
| apache/tomcat | ≥ 7.0.0, ≤ 7.0.70 | — |
| apache/tomcat | ≥ 8.0, ≤ 8.0.36 | — |
| apache/tomcat | ≥ 8.5.0, ≤ 8.5.4 | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| netapp/oncommand_insight | all versions | — |
| netapp/oncommand_shift | all versions | — |
| netapp/snap_creator_framework | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| debian/debian_linux | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |
| redhat/jboss_enterprise_web_server | all versions | — |
| redhat/enterprise_linux_desktop | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_server | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_workstation | all versions | — |
| oracle/tekelec_platform_distribution | ≥ 7.4.0, ≤ 7.7.1 | — |